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Preface 



The Department of Homeland Security (DHS) Office of Inspector General (OIG) was 
established by the Homeland Security Act of 2002 (Public Law 107-296) by amendment 
to the Inspector General Act of 1978. This is one of a series of audit, inspection, and 
special reports prepared as part of our oversight responsibilities to promote economy, 
efficiency, and effectiveness within the department. 

This report presents the revised National Flood Insurance Program Management Letter 
for DHS FY 2009 Consolidated Financial Statements Audit. It contains observations 
related to internal control that were not required to be reported in the financial statements 
audit report. The independent public accounting firm KPMG LLP (KPMG) performed 
the integrated audit of DHS' FY 2009 financial statements and internal control over 
financial reporting and prepared this management letter. KPMG is responsible for the 
attached management letter dated November 13, 2009 and the conclusions expressed in 
it. We do not express opinions on DHS' financial statements or internal control or 
provide conclusions on compliance with laws and regulations. 

The observations herein have been discussed in draft with those responsible for 
implementation. We trust this report will result in more effective, efficient, and 
economical operations. We express our appreciation to all of those who contributed to 
the preparation of this report. 




Anne L. Richards 

Assistant Inspector General for Audits 



NATIONAL FLOOD INSURANCE PROGRAM 

Management Letter for the 
Year Ended September 30, 2009 



KPMG LLP 

2001 M Street, NW 
Washington, DC 20036 



Office of Inspector General, U.S. Department of Homeland Security, and 

Acting Assistant Administrator, Mitigation Directorate, Federal Emergency Management Agency, U.S. 
Department of Homeland Security, Washington, DC 

November 13,2009 

Ladies and Gentlemen: 

We were engaged to audit the balance sheet of the U.S. Department of Homeland Security (DHS) as of 
September 30, 2009, and the related statement of custodial activity for the year then ended (referred to 
herein as "financial statements"). We were also engaged to examine internal control over financial 
reporting (internal control) of the financial statements. In connection with our fiscal year 2009 
engagement, we considered compliance with certain provisions of applicable laws, regulations, contracts, 
and grant agreements that could have a direct and material effect on the financial statements. We were not 
engaged to audit the statements of net cost, changes in net position, and budgetary resources for the year 
ended September 30, 2009 (referred to herein as "other financial statements"), or to examine internal 
control over financial reporting over the other financial statements. Because of matters discussed in our 
Independent Auditors' Report dated November 13, 2009, the scope of our work was not sufficient to 
enable us to express, and we did not express, an opinion on the financial statements as of September 30, 
2009, and we were unable to perform procedures necessary to form an opinion, and we did not express an 
opinion, on internal control over financial reporting of the financial statements as of September 30, 2009. 

During our audit engagement, we noted certain matters involving the Federal Emergency Management 
Agency's (FEMA) National Flood Insurance Program (NFIP) internal control and other operational 
matters that are presented for your consideration. These observations and recommendations, all of which 
have been discussed with the appropriate members of management of the named insurance companies 
(where applicable), FEMA's Office of the Chief Financial Officer, and FEMA's Mitigation Directorate, 
are intended to improve internal control or result in other operating efficiencies, are not considered to 
reflect significant deficiencies or material weaknesses in internal control over financial reporting, and are 
summarized in Exhibit I of this letter. The status of our prior year observations is presented in Exhibit II. 

We identified certain deficiencies in internal control that we consider to be significant deficiencies and 
material weaknesses, and communicated them in our Independent Auditors' Report, dated November 13, 
2009, included in the fiscal year 2009 DHS Annual Financial Report. Certain control deficiencies related 
to FEMA information technology (IT) controls will be presented in a separate letter to the DHS Office of 
Inspector General and the FEMA Chief Information Officer, and certain other control deficiencies related 
to FEMA's internal controls exclusive of our IT findings will be presented in a separate letter to the DHS 
Office of Inspector General and the DHS Acting Chief Financial Officer. 

As described above, the scope of our work was not sufficient to express an opinion on the balance sheet 
or statement of custodial activity of DHS or the related internal control as of September 30, 2009, and we 
were not engaged to audit the statements of net cost, changes in net position, and budgetary resources or 
the related internal control for the year ended September 30, 2009. Accordingly, other internal control 
matters and instances of non-compliance may have been identified and reported had we been able to 
perform all procedures necessary to express opinions on the fiscal year 2009 financial statements and on 
fiscal year 2009 internal control over financial reporting of the financial statements and had we been 
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member firm of KPMG International, a Swiss cooperative. 



engaged to audit the fiscal year 2009 other financial statements and fiscal year 2009 internal control over 
financial reporting of the other financial statements. We aim, however, to use our knowledge of NFIP 
gained during our work to make observations and suggestions that we hope will be useful to you. 

We would be pleased to discuss these observations and recommendations with you at any time. 

Management's written response to our observations and recommendations in Exhibit III has not been 
subjected to the auditing procedures applied in the financial statement audit engagement and, accordingly, 
we express no opinion on it. 

This letter is intended solely for the information and use of DHS and FEMA management, DHS Office of 
Inspector General, the Office of Management and Budget, U.S. Government Accountability Office, the 
U.S. Congress, and management of the named insurance companies, and is not intended to be and should 
not be used by anyone other than these specified parties. 

Very truly yours, 
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I. INTERNAL CONTROL DEFICIENCIES RELATED TO CLAIMS 
A. Internal Control Deficiencies Identified over Claims Paid 

Observation 

We selected 12 insurance companies to perform audit procedures over claims paid for the periods October 
1, 2008 through March 31, 2009, April 1 through June 30, 2009, and July 1 through August 31, 2009. For 
the 12 companies selected, we tested a sample of claims paid totaling 688 items covering the three testing 
periods identified above. During this testing, we noted the following internal control deficiencies and 
errors: 

1) Based on our March 31, 2009 testwork, for one sample item,the claims file was not complete and the 
Final Report was not approved before the claim payment was processed and issued. 



Company 


Policy Number 


Loss Date 


Claim Payment 










09/13/2008 


$ 4,250.23 



2) Based on our March 31, 2009 testwork, for six sample items, the total amount paid to the insured did 
not agree to the amount indicated on the Final Report. 



Company 


Policy Number 


Loss Date 


Claim Payment 








09/13/2008 


$ 44,008.02 








08/21/2008 


$ 9,876.40 










09/06/2008 


$ 1,668.50 










09/06/2008 


$ 6,929.06 










09/13/2008 


$ 32,330.15 










09/13/2008 


$ 31,400.00 



3) Based on our March 31, 2009 testwork, for one sample item, the claim check was not properly 
authorized. 



Company 


Policy Number 


Loss Date 


Claim Payment 










09/12/2008 


$ 10,025.96 



4) Based on our March 31, 2009, June 30, 2009, and August 31, 2009 testwork, for 14 sample items, the 
payments to the insurance company/adjusting firm for servicing the claim did not agree with the 
National Flood Insurance Program (NFIP) Fee Schedule. 



March 31, 2009 Testwork Results: 



Company 


Policy Number 


Loss Date 


LAE Payment 






09/13/2008 


$ 1,795.55 






09/13/2008 


$ 1,725.39 










08/01/2008 


$ 925.00 










09/01/2008 


$ 1,001.31 










05/01/2008 


$ 2,000.00 
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Company 


Policy Number 


Loss Date 


LAE Payment 






09/13/2008 


$ 2,981.94 






09/14/2008 


$ 3,935.62 






09/21/2008 


$ 1,025.00 



June 30, 2009 Testwork Results: 



Company 


Policy Number 


Loss Date 


LAE Payment 








08/29/2005 


$ 123.72 








06/23/2008 


$ 225.00 








08/29/2005 


$ 3,947.70 



August 31, 2009 Testwork Results: 



Company 


Policy Number 


Loss Date 


LAE Payment 






08/22/2007 


$ 1,790.00 






04/28/2009 


$ 1,099.31 






09/13/2008 


$ 4,319.14 



5) Based on our March 31, 2009 testwork, for eight sample items, loss reserves were not established at 
the correct amount when the insurance company received notification of loss. 



Company 


Policy Number 


Loss Date 








09/13/2008 












09/01/2008 












09/01/2008 








09/01/2008 








09/01/2008 












09/01/2008 








06/01/2008 












09/01/2008 



Based on the results for the period ended March 31, 2009, this control was not tested during the 
periods of April 1 through June 30, 2009 and July 1 through August 31, 2009. 

6) Based on our March 31, 2009 testwork, for 15 sampfe items, the loss reserve amounts were not 
adjusted as claim payments were made to the policyholder. 



Company 


Policy Number 


Loss Date 








09/13/2008 








09/13/2008 








09/13/2008 






09/01/2008 






09/01/2008 
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Company 


Policy Number 


Loss Date 








08/01/2008 










09/01/2008 










09/01/2008 










09/01/2008 










09/01/2008 










AO/1 O/OAAO 








08/21/2008 








09/21/2008 










09/21/2008 










09/22/2008 



Based on the results for the period ended March 31, 2009, this control was not tested during the 
periods of April 1 through June 30, 2009 and July 1 through August 31, 2009. 

7) Based on our March 31, 2009 testwork, for one sample item, for an open claim, the loss reserve 
amount was prematurely reduced to zero prior to the claim being closed. 



Company 


Policy Number 


Loss Date 










09/01/2008 



Based on the results for the period ended March 31, 2009, this control was not tested during the 
periods of April 1 through June 30, 2009 and July 1 through August 31, 2009. 

Recommendations 

We recommend that the Federal Emergency Management Agency's (FEMA) Mitigation Directorate: 

1) Follow-up with each of the insurance companies noted above to determine that appropriate corrective 
action has been implemented to address the exceptions noted in our testwork. 

2) Provide increased oversight to insurance companies participating in the NFIP to ensure claims files 
are being processed and reviewed in accordance with NFIP guidelines before approval and issuance 
of claim payments and to ensure the specific and consistent establishment and reporting of loss 
reserves and subsequent adjustments to the loss reserves. 

B. Inaccuracies in Claims' Loss Reserves 

Observation 

We selected 12 insurance companies to perform audit procedures over the accuracy and completeness of 
loss reserves established as of March 31, 2009 and June 30, 2009. For the 12 companies selected, we 
tested a sample of loss reserves reported as of March 31, 2009 and June 30, 2009, totaling 210 items and 
275 items tested, respectively. During this testing, we noted the following inaccuracies at the respective 
insurance companies: 

1) Based on our March 31, 2009 and June 30, 2009 testwork, for eight sample items, the loss reserve 
was not adjusted for subsequent claims adjuster documentation: 
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March 31, 2009: 



Company 


Policy Number 


Loss Date 


Loss Reserve 






09/13/2008 


$ 13,000.00 








09/13/2008 


$ 10,000.00 








09/13/2008 


$ 32,719.00 








09/13/2008 


$ 15,000.00 



June 30, 2009: 



Company 


Policy Number 


Loss Date 


Loss Reserve 










04/28/2009 


$ 140,000.00 










04/27/2009 


$ 8,700.00 










05/09/2009 


$ 15,000.00 










04/28/2009 


$ 5,000.00 



Based on our March 31, 2009 and June 30, 2009 testwork, for 11 sample items, the loss reserve was 
not adjusted for partial and/or advance payments made to the policyholder: 



March 31, 2009: 



Company 


Policy Number 


Loss Date 


Loss Reserve 








09/24/2005 


$ 30,000.00 








09/13/2008 


$ 30,000.00 








08/29/2005 


$ 8,650.00 



June 30, 2009: 



Company 


Policy Number 


Loss Date 


Loss Reserve 






09/13/2008 


$ 230,000.00 






06/10/2009 


$ 26,303.14 






03/28/2009 


$ 17,062.29 






05/09/2009 


$ 41,193.22 






05/09/2009 


$ 79,913.86 






04/24/2009 


$ 55,000.00 






08/29/2005 


$ 30,000.00 






08/29/2005 


$ 30,000.00 



Based on our March 31, 2009 and June 30, 2009 testwork, for 14 sample items, the loss reserve was 
not closed in a timely manner after full payment of the claim was made to the policyholder: 



March 31, 2009: 



Company 


Policy Number 


Loss Date 


Loss Reserve 












08/29/2005 


$ 20,050.00 
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Company 


Policy Number 


Loss Date 


Loss Reserve 














07/10/2005 


$ 30,000.00 












08/29/2005 


$ 30,000.00 








Uj/iy/zuu4 
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09/06/2004 


$ 30,000.00 








05/30/2004 


$ 30,000.00 








09/08/2004 


$ 30,000.00 








02/07/2008 


$ 2,510.26 



June 30, 2009: 



Company 


Policy Number 


Loss Date 


Loss Reserve 










10/24/2005 


$ 


20,622.90 










09/16/2004 


$ 


30,000.00 












09/16/2004 


$ 


30,000.00 












09/05/2004 


$ 


30,000.00 












05/30/2004 


$ 


30,000.00 










09/13/2008 


$ 


4,250.00 



4) Based on our June 30, 2009 testwork, for two sample items, the entire or partial loss reserve was not 
supported by adequate documentation: 



Company 


Policy Number 


Loss Date 


Loss Reserve 








09/04/2004 


$ 41,829.85 








06/08/2001 


$ 30,000.00 



5) Based on our June 30, 2009 testwork, for two sample items, the loss reserve was not appropriately 
established/adjusted due to a claims adjuster clerical error: 



Company 


Policy Number 


Loss Date 


Loss Reserve 






04/18/2009 


$ 5,000.00 






06/10/2008 


$ 10,675.00 



6) Based on our June 30, 2009 testwork, for one sample item, the loss reserve resulted from a duplicate 
reserve being created for a policy that was transitioned to a different policy number: 



Company 


Policy Number 


Loss Date 


Loss Reserve 










04/26/2008 


$ 30,000.00 



7) Based on our June 30, 2009 testwork, for one sample item, the loss reserve was adjusted for a claim 
payment prior to the claim payment being paid to the policyholder: 



Company 


Policy Number 


Loss Date 


Loss Reserve 










06/04/2008 


$ 1,128.29 
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Recommendations 

We recommend that FEMA's Mitigation Directorate: 

1) Provide adequate oversight for each insurance company during a vendor merger or vendor transition 
to ensure the new vendor maintains the necessary documents in order to support the financial 
transactions and balances it is inheriting. 

2) Follow-up with each of the insurance companies noted above to determine that appropriate corrective 
action has been implemented to address the exceptions noted in our testwork. 

3) Provide increased oversight to ensure the specific and consistent documentation of the established 
loss reserve and subsequent adjustment to the loss reserve per claim in the claim file at the insurance 
companies participating in the NFIP is maintained. 

II. OTHER INTERNAL CONTROL DEFICIENCIES 

A. Internal Control Deficiencies Related to NFIP Restricted Bank Accounts 

Observation 

We selected 12 insurance companies to perform audit procedures over the NFIP restricted bank account 
reconciliations, and we noted the following exceptions for the period ended March 31, 2009: 

1) For 5 of the 12 insurance companies selected, we noted that lockbox receipts received on the last day 
of the month (i.e., March 31, 2009) were not included in each company's general ledger but were 
included in the company's bank balance. Therefore, the amount of cash recorded in the insurance 
company's general ledger was understated for these insurance companies for the period ended March 
31,2009. 

2) For , we noted that its prior NFIP vendor wired $1,424,596 to the company in fiscal year 
2009 before the transition to new NFIP vendor. At the time of our audit procedures, 
neither nor the prior vendor could explain the purpose of the transaction or provide 
supporting documentation for the item. The current vendor determined that $319,353 of the transfer 
related to stale checks and subsequently recorded this amount in general ledger in 
February 2009. As of July 31, 2009, the purpose of the transaction had not been determined. 

3) For , we noted two unsupported reconciling items on the March 31, 2009 bank 
reconciliation. The current vendor purchased the prior vendor in fiscal year 2005 and inherited the 
two reconciling items included in the prior vendor's bank account. Thus, these items were included 
in the bank account but not in the general ledger. 

The table below provides a listing of the insurance companies discussed above, the understatement of 
cash dollar value per company at March 31, 2009, and the total understatement of cash dollar value at 
March 31, 2009. 



Insurance Company 


Understatement 




$ (13,656) 




$ (69,404) 




$ (8,318) 




$ (1,175,855) 
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Insurance Company 


Understatement 




$ (6,420) 




$ (47,971) 


Total 


$ (1,321,624) 



Recommendations 

We recommend that FEMA's Mitigation Directorate: 

1) Follow-up with each of the insurance companies noted above to determine that appropriate corrective 
action has been implemented to address the exceptions noted in our testwork. 

2) Provide increased oversight to insurance companies participating in the NFIP to ensure that NFIP 
cash management procedures are being followed by insurance companies in accordance with NFIP 
guidelines. 

3) Provide adequate oversight for each insurance company during a vendor merger or vendor transition 
to ensure the new vendor maintains the necessary documents in order to support the financial 
transactions and balances it is inheriting. 

B. Internal Control Deficiencies in the Claims Reinspection and Submit for Rate Programs 

Observation 

In fiscal year 2008, during our interim control testwork, we identified instances where FEMA did not 
consistently maintain documentation of the Submit for Rate review and/or follow-up on underwriting 
errors nor follow-up appropriately on claim reinspections with the insurance companies. 

As of the start of our fiscal year 2009 audit procedures, the current NFIP service provider had been 
instructed by FEMA's Mitigation Directorate to begin using the NextGen 'FREE' and 'ezClaims' 
applications for all Submit for Rate Program and Claims Reinspection Program functions, respectively, 
even though NextGen did not have the authority to operate on a Department of Homeland Security (DHS) 
network and was not the system of record. 

Based on that information, the Submit for Rate Program and the Claims Reinspection Program were not 
operating using policy and claim data from the NFIP system of record (i.e., Transaction Record Reporting 
and Processing [TRRP] system) throughout fiscal year 2009. 

Recommendation 

We recommend that FEMA's Mitigation Directorate use the official NFIP system of record as the basis 
for the Submit for Rate and Claims Reinspection Programs and not transition these program activities to a 
new system before it is authorized to operate as the system of record. 

C. Insufficient FEMA Oversight of the NFIP Service Provider's Methodology Used to Calculate 
Estimates Reported in the FEMA Financial Statements 

Observation 

In fiscal year 2008, we noted that the NFIP service provider's methodology was insufficiently 
documented to allow a reasonable person to re-perform the year-end estimates and yield the same results. 
For fiscal year 2009, the NFIP service provider updated the methodology to address the prior year 
documentation deficiency. 
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The financial statement estimates for the NFIP are based on the service provider's judgments, historical 
knowledge, and assumptions to determine the final value of a variety of material account balances. Since 
the Mitigation Directorate is the responsible division within FEMA for the management and oversight of 
the NFIP and the Office of the Chief Financial Officer (OCFO) inherits the risks associated with the third 
party service provider's processing and reporting of the NFIP financial data to FEMA, the Mitigation 
Directorate should have obtained and provided this information to the OCFO's Financial Management 
Division, which in turn should have reviewed and approved the methodology used by the service provider 
to report significant line items. 

For fiscal year 2009, we obtained and reviewed the updated deferred revenue, deferred acquisition cost, 
and accounts payable methodology from the service provider and followed-up with the FEMA OCFO 
concerning the sufficiency of the methodology. Based on the follow-up performed, we observed that the 
Mitigation Directorate did not provide the deferred revenue, deferred acquisition cost, and accounts 
payable methodology to the FEMA OCFO, and consequently, we concluded that as of July 1, 2009, the 
OCFO had not reviewed and approved the service provider's estimation methodology for the NFIP 
financial statements and ultimately the FEMA financial statements. 

The OCFO reviewed and approved the methodology on July 10, 2009 after we informed them of this 
deficiency. 

Recommendation 

We recommend that FEMA's OCFO and Mitigation Directorate develop and implement procedures for 
the OCFO's Financial Management Division to timely complete such a review and approval whenever 
changes are made to the NFIP service provider's estimation methodology, to include procedures for the 
Mitigation Directorate to obtain and provide the changes to the OCFO timely. 

D. Monitoring and Communication of Significant Financial-Related Matters in the NFIP 

Observation 

During fiscal year 2008, based on control testwork and observations and communications with FEMA 
personnel, we noted the following areas where financial management improvements were needed in 
monitoring the NFIP operations: 

• Retrospective Reserve Analysis 

• Change in Service Provider 

• Change in NFIP Systems 

• Changes to the Actuarial Liability and the Related Actuary Report 

Based on our fiscal year 2009 control testwork, observations and communications with FEMA personnel, 
we noted the aforementioned conditions had been remediated during the current fiscal year. However, 
during our testwork in current year over the NFIP deferred revenue estimate, we noted that the service 
provider unilaterally changed the estimation methodology on October 7, 2009. The methodology 
changed from deferred revenue being based on a two-year historical growth percentage, which was 
applied to August deferred revenue to calculate September deferred revenue, to deferred revenue being 
based on a function of written premium. A three-year historical percentage of deferred revenue derived 
from written premium was applied to the September 2009 written premium balance to estimate deferred 
revenue at September 30, 2009. Based on our corroborative inquiry with the OCFO and Mitigation 
Directorate, we noted that both divisions were unaware of the change to the year-end deferred revenue 
methodology. The related estimate was recorded in FEMA's general ledger. 
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Recommendations 

We recommend that the: 

1) Mitigation Directorate develop and implement communication protocols with the service provider to 
ensure that significant financial-related events are timely communicated to the Mitigation Directorate. 

2) Mitigation Directorate designate a point of contact responsible for the timely communication of 
significant financial-related events with the service provider and the OCFO. 

3) OCFO develop and implement communication protocols with the Mitigation Directorate for 
significant financial-related events and designate a point of contact responsible for these 
communications and related accounting and reporting action. 



1.9 



Status of Prior Year Observations 



Exhibit II 



The status of each observation reported in our letter dated November 14, 2008 to the Office of Inspector 
General, U.S. Department of Homeland Security, and Acting Administrator, Mitigation Division, Federal 
Emergency Management Agency, U.S. Department of Homeland Security, is summarized in the table 
below. For each repeated observation, we provided the current year Observation Number and Notice of 
Findings and Recommendations (NFR) Number. 





Disposition 


2008 






Repeat (2009 


Observation 


Description 


Closed 


Observation No./ 



LA 


Internal Control Deficiencies Identified over Claims 
Paid - Interim Testing 




LA/ FEMA 09-36 


LB 


lllieilldl ^/OllLlOl -L/eilClGllClGa lUGllllllGU. OVGI \^/ldllil& 

Paid - Final Testing 




LA/ FEMA 09-36 


LC 


Inaccuracies in Interim Claims' Loss Reserves 




LB/ FEMA 09-37 


I.D 


Internal Control Deficiencies in the Claims 
Reinspection Program 




II.B/ FEMA 09-41 


II.A 


Internal Control Deficiencies Identified over 
Premiums Written 


X 




II.B 


Internal Control Deficiencies in the Submit for Rate 
Program 




II.B/ FEMA 09-41 


IILA 


Insufficient Documentation of Methodology Used 
to Calculate NFIP Estimates Reported in the FEMA 
Financial Statements 




ILC/ FEMA 09-39 
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U.S. Department or I [time Land Security 
500 C Street. SW 
Washington. DC 20472 




FEMA 



National Flood Insurance Program 
Mitigation Directorate 
Response to Management Letter for the Year Ended September 30, 2009 

February 23, 2010 

I. Internal Control Deficiencies Related to Claims 

A. Internal Control Deficiencies Identified over Claims Paid 

Management has. initiated follow-up with the WYO companies on the exceptions noted and will 
continue to review WYO company claims handling as part of the ongoing claims operation reviews. 

While there is a referenced to reliance on these claims data in establishing reserves, Management does 
not believe that it is material to the reserving process* As Management has explained, reserving works 
best when there is consistency in case loss reserves. 

B. . Inaccuracies in Claims' Loss Reserv es 

Management will reissue the NFIP Case Lass Resenting Procedures and will address the vendor merger or 
vendor transition issue in the cover letter of the reissued bulletin. During the FY 2010 claims operation 
review cycle, Management will review WYO companies" compliance w ith the revised claims loss reserve 
procedures. Management will initiate follow-up with the WYO companies on die exceptions noted 
above. 

While there is a referenced to reliance on these claims data in establishing reserves, Management docs 
not believe that it is material to the reserving process. As Management has explained, reserv ing works 
best when there is consistency in case loss reserves. 

II, Other Internal Control Deficiencies 

A. Internal Control Deficiencies Related to NFIP Restricted Bank Accounts 

All exceptions were addressed hv September 30, 2009. 

Management has and will continue to monitor the cash management practices of the WYO program 
through monthly reconciliations of financial and statistical information, ongoing audit programs, and 
WYO Standards Committee of company performance. Management has and will continue to monitor 
vendor transitions through monthly data reconciliations, ongoing audit programs, and WYO Standards 
Committee oversight. 

wwsv.ttmvgov 
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B. Internal Control Deficiencies in the Claims Re inspection and Submit for Rate Programs 

Management will continue to use the official NFIP system of record as the basis of the Submit for Rare 
and Claims Rcinspecnon Program and nor transition these program activities to a new system before it 
is authorized to operate as the system of record. 

C. Insufficient FEMA Oversight of the NFIP Service Provider's Methodology Used to 
Calculate Estimates Reported in the FEMA Financial Statements 

Management will seek FEMA OCFO*s approval whenever changes are made to the NFIP service 
provider's estimation methodology and will develop procedures for the Mitigation Directorate to obtain 
and provide changes to the OCFO in a timely manncr. 

D. Monitoring and Communication of Significant Financial-Related Matters in the NFIP 

Management wiO develop and implement communication prorocols with the service provider to ensure 
communication of significant financial-related events in a timely manner and has designated a point of 
contact for communicating these matters to the OCFO and the NFIP sendee provider. 




Edward L. Connor 
Acting Federal Insurance and Mitigation Administrator 
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Secretary 

Deputy Secretary 

Chief of Staff 

Deputy Chief of Staff 

General Counsel 

Executive Secretariat 

Director, GAO/OIG Liaison Office 

Assistant Secretary for Office of Policy 

Assistant Secretary for Office of Public Affairs 

Assistant Secretary for Office of Legislative Affairs 

Chief Financial Officer 

Chief Information Officer 

Federal Emergency Management Agency 

FEMA Administrator 
Chief Financial Officer 
FEMA Audit Liaison 
Director of Mitigation Division 
Chief of Risk Insurance 

Office of Management and Budget 

Chief, Homeland Security Branch 
DHS OIG Budget Examiner 

Congress 

Congressional Oversight and Appropriations Committees, as 
appropriate 



ADDITIONAL INFORMATION AND COPIES 

To obtain additional copies of this report, please call the Office of Inspector General (OIG) at (202) 254-4100, 
fax your request to (202) 254-4305, or visit the OIG web site at www.dhs.gov/oig. 



OIG HOTLINE 

To report alleged fraud, waste, abuse or mismanagement, or any other kind of criminal or noncriminal 
misconduct relative to department programs or operations: 

• Call our Hotline at 1-800-323-8603; 

• Fax the complaint directly to us at (202) 254-4292; 

• Email us at DHSOIGHOTLINE@dhs.gov; or 

• Write to us at: 

DHS Office of Inspector General/MAIL STOP 2600, 
Attention: Office of Investigations - Hotline, 
245 Murray Drive, SW, Building 410, 
Washington, DC 20528. 



The OIG seeks to protect the identity of each writer and caller. 



